Freeradius 3.0.13-8.el7_4 and external syslog server
Hello Freeradius Users, I have installed a freeradius server on Centos 7. Now I want to have the freeradius messages forwarded to a external syslog server. Within the radiusd.conf I have changed the "logdir" and "destination" parameter to "syslog" Also added the *.* @IPAddress:514 at the end of the rsyslog.conf file. Restarted both the rsyslog and radiusd service, but then no client will authenticate. I'm getting the following errors: *-- 2018-02-26 08:46:48 Daemon.Debug servername.local Feb 26 08:46:48 SERVERNAME radiusd[31843]: (0) auth_log: ERROR: Couldn't open file syslog/radacct/192.168.1.7/auth-detail-20180226: Failed to create directory syslog: Permission denied 2018-02-26 08:46:48 Daemon.Notice servername.local Feb 26 08:46:48 SERVERNAME radiusd[31843]: (0) Invalid user (auth_log: Couldn't open file syslog/radacct/192.168.1.7/auth-detail-20180226: Failed to create directory syslog: Permission denied): [b8386116681f/b8386116681f] (from client SWITCHNAME port 50001 cli B8-38-61-16-68-1F) 2018-02-26 08:46:48 Daemon.Info servername.local Feb 26 08:46:48 SERVERNAME radiusd[31843]: Need 4 more connections to reach 10 spares 2018-02-26 08:46:48 Daemon.Info servername.local Feb 26 08:46:48 SERVERNAME radiusd[31843]: rlm_sql (SHBMSQL01): Opening additional connection (6), 1 of 26 pending slots used 2018-02-26 08:46:57 Daemon.Debug servername.local Feb 26 08:46:57 SERVERNAME radiusd[31843]: (1) auth_log: ERROR: Couldn't open file syslog/radacct/192.168.1.7/auth-detail-20180226: Failed to create directory syslog: Permission denied 2018-02-26 08:46:57 Daemon.Notice servername.local Feb 26 08:46:57 SERVERNAME radiusd[31843]: (1) Invalid user (auth_log: Couldn't open file syslog/radacct/192.168.1.7/auth-detail-20180226: Failed to create directory syslog: Permission denied): [b8386116681f/b8386116681f] (from client SWITCHNAME port 50001 cli B8-38-61-16-68-1F) 2018-02-26 08:46:57 Daemon.Info servername.local Feb 26 08:46:57 SERVERNAME radiusd[31843]: Need 3 more connections to reach 10 spares 2018-02-26 08:46:57 Daemon.Info servername.local Feb 26 08:46:57 SERVERNAME radiusd[31843]: rlm_sql (SHBMSQL01): Opening additional connection (7), 1 of 25 pending slots used 2018-02-26 08:47:13 Daemon.Error servername.local Feb 26 08:47:13 SERVERNAME radiusd[31843]: Ignoring request to auth address * port 1812 bound to server default from unknown client 192.168.1.192 port 1645 proto udp 2018-02-26 08:47:18 Daemon.Error servername.local Feb 26 08:47:18 SERVERNAME radiusd[31843]: Ignoring request to auth address * port 1812 bound to server default from unknown client 192.168.1.192 port 1645 proto udp 2018-02-26 08:47:23 Daemon.Error servername.local Feb 26 08:47:23 SERVERNAME radiusd[31843]: Ignoring request to auth address * port 1812 bound to server default from unknown client 192.168.1.192 port 1645 proto udp 2018-02-26 08:47:28 Daemon.Error servername.local Feb 26 08:47:28 SERVERNAME radiusd[31843]: Ignoring request to auth address * port 1812 bound to server default from unknown client 192.168.1.192 port 1645 proto udp *-- Thank you for your help. Kind Regards, Bram.
On 26/02/2018, at 9:39 PM, Bram Assendorp <bramassendorp@gmail.com> wrote:
Hello Freeradius Users,
I have installed a freeradius server on Centos 7.
Now I want to have the freeradius messages forwarded to a external syslog server.
Can you be more specific here? Do you want the RADIUS messages (i.e. what is written to detail files) sent to syslog, or do you want FreeRADIUS daemon messages sent to syslog?
Within the radiusd.conf I have changed the "logdir" and "destination" parameter to “syslog”
As you can see from your logs, changing logdir to “syslog” means it tries to write to a directory called “syslog”. Not sure why you changed that parameter as the documentation all around there is quite clear on what that parameter does, but, change it back.
Also added the *.* @IPAddress:514 at the end of the rsyslog.conf file.
Restarted both the rsyslog and radiusd service, but then no client will authenticate.
I'm getting the following errors:
*--
2018-02-26 08:46:48 Daemon.Debug servername.local Feb 26 08:46:48 SERVERNAME radiusd[31843]: (0) auth_log: ERROR: Couldn't open file syslog/radacct/192.168.1.7/auth-detail-20180226: Failed to create directory syslog: Permission denied 2018-02-26 08:46:48 Daemon.Notice servername.local Feb 26 08:46:48 SERVERNAME radiusd[31843]: (0) Invalid user (auth_log: Couldn't open file syslog/radacct/192.168.1.7/auth-detail-20180226: Failed to create directory syslog: Permission denied): [b8386116681f/b8386116681f] (from client SWITCHNAME port 50001 cli B8-38-61-16-68-1F) 2018-02-26 08:46:48 Daemon.Info servername.local Feb 26 08:46:48 SERVERNAME radiusd[31843]: Need 4 more connections to reach 10 spares 2018-02-26 08:46:48 Daemon.Info servername.local Feb 26 08:46:48 SERVERNAME radiusd[31843]: rlm_sql (SHBMSQL01): Opening additional connection (6), 1 of 26 pending slots used 2018-02-26 08:46:57 Daemon.Debug servername.local Feb 26 08:46:57 SERVERNAME radiusd[31843]: (1) auth_log: ERROR: Couldn't open file syslog/radacct/192.168.1.7/auth-detail-20180226: Failed to create directory syslog: Permission denied 2018-02-26 08:46:57 Daemon.Notice servername.local Feb 26 08:46:57 SERVERNAME radiusd[31843]: (1) Invalid user (auth_log: Couldn't open file syslog/radacct/192.168.1.7/auth-detail-20180226: Failed to create directory syslog: Permission denied): [b8386116681f/b8386116681f] (from client SWITCHNAME port 50001 cli B8-38-61-16-68-1F) 2018-02-26 08:46:57 Daemon.Info servername.local Feb 26 08:46:57 SERVERNAME radiusd[31843]: Need 3 more connections to reach 10 spares 2018-02-26 08:46:57 Daemon.Info servername.local Feb 26 08:46:57 SERVERNAME radiusd[31843]: rlm_sql (SHBMSQL01): Opening additional connection (7), 1 of 25 pending slots used 2018-02-26 08:47:13 Daemon.Error servername.local Feb 26 08:47:13 SERVERNAME radiusd[31843]: Ignoring request to auth address * port 1812 bound to server default from unknown client 192.168.1.192 port 1645 proto udp 2018-02-26 08:47:18 Daemon.Error servername.local Feb 26 08:47:18 SERVERNAME radiusd[31843]: Ignoring request to auth address * port 1812 bound to server default from unknown client 192.168.1.192 port 1645 proto udp 2018-02-26 08:47:23 Daemon.Error servername.local Feb 26 08:47:23 SERVERNAME radiusd[31843]: Ignoring request to auth address * port 1812 bound to server default from unknown client 192.168.1.192 port 1645 proto udp 2018-02-26 08:47:28 Daemon.Error servername.local Feb 26 08:47:28 SERVERNAME radiusd[31843]: Ignoring request to auth address * port 1812 bound to server default from unknown client 192.168.1.192 port 1645 proto udp
*--
Thank you for your help.
Kind Regards,
Bram. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi, I have changed it because it's in the wiki " https://wiki.freeradius.org/guide/Syslog-HOWTO" I want to have everything that now is written in to the radius.log file, to the syslog server. Thank you for your quick reply. Kind Regards, Bram Assendorp 2018-02-26 9:48 GMT+01:00 Nathan Ward <lists+freeradius@daork.net>:
On 26/02/2018, at 9:39 PM, Bram Assendorp <bramassendorp@gmail.com> wrote:
Hello Freeradius Users,
I have installed a freeradius server on Centos 7.
Now I want to have the freeradius messages forwarded to a external syslog server.
Can you be more specific here? Do you want the RADIUS messages (i.e. what is written to detail files) sent to syslog, or do you want FreeRADIUS daemon messages sent to syslog?
Within the radiusd.conf I have changed the "logdir" and "destination" parameter to “syslog”
As you can see from your logs, changing logdir to “syslog” means it tries to write to a directory called “syslog”. Not sure why you changed that parameter as the documentation all around there is quite clear on what that parameter does, but, change it back.
Also added the *.* @IPAddress:514 at the end of the rsyslog.conf file.
Restarted both the rsyslog and radiusd service, but then no client will authenticate.
I'm getting the following errors:
*--
2018-02-26 08:46:48 Daemon.Debug servername.local Feb 26 08:46:48 SERVERNAME radiusd[31843]: (0) auth_log: ERROR: Couldn't open file syslog/radacct/192.168.1.7/auth-detail-20180226: Failed to create directory syslog: Permission denied 2018-02-26 08:46:48 Daemon.Notice servername.local Feb 26 08:46:48 SERVERNAME radiusd[31843]: (0) Invalid user (auth_log: Couldn't open file syslog/radacct/192.168.1.7/auth-detail-20180226: Failed to create directory syslog: Permission denied): [b8386116681f/b8386116681f] (from client SWITCHNAME port 50001 cli B8-38-61-16-68-1F) 2018-02-26 08:46:48 Daemon.Info servername.local Feb 26 08:46:48 SERVERNAME radiusd[31843]: Need 4 more connections to reach 10 spares 2018-02-26 08:46:48 Daemon.Info servername.local Feb 26 08:46:48 SERVERNAME radiusd[31843]: rlm_sql (SHBMSQL01): Opening additional connection (6), 1 of 26 pending slots used 2018-02-26 08:46:57 Daemon.Debug servername.local Feb 26 08:46:57 SERVERNAME radiusd[31843]: (1) auth_log: ERROR: Couldn't open file syslog/radacct/192.168.1.7/auth-detail-20180226: Failed to create directory syslog: Permission denied 2018-02-26 08:46:57 Daemon.Notice servername.local Feb 26 08:46:57 SERVERNAME radiusd[31843]: (1) Invalid user (auth_log: Couldn't open file syslog/radacct/192.168.1.7/auth-detail-20180226: Failed to create directory syslog: Permission denied): [b8386116681f/b8386116681f] (from client SWITCHNAME port 50001 cli B8-38-61-16-68-1F) 2018-02-26 08:46:57 Daemon.Info servername.local Feb 26 08:46:57 SERVERNAME radiusd[31843]: Need 3 more connections to reach 10 spares 2018-02-26 08:46:57 Daemon.Info servername.local Feb 26 08:46:57 SERVERNAME radiusd[31843]: rlm_sql (SHBMSQL01): Opening additional connection (7), 1 of 25 pending slots used 2018-02-26 08:47:13 Daemon.Error servername.local Feb 26 08:47:13 SERVERNAME radiusd[31843]: Ignoring request to auth address * port 1812 bound to server default from unknown client 192.168.1.192 port 1645 proto udp 2018-02-26 08:47:18 Daemon.Error servername.local Feb 26 08:47:18 SERVERNAME radiusd[31843]: Ignoring request to auth address * port 1812 bound to server default from unknown client 192.168.1.192 port 1645 proto udp 2018-02-26 08:47:23 Daemon.Error servername.local Feb 26 08:47:23 SERVERNAME radiusd[31843]: Ignoring request to auth address * port 1812 bound to server default from unknown client 192.168.1.192 port 1645 proto udp 2018-02-26 08:47:28 Daemon.Error servername.local Feb 26 08:47:28 SERVERNAME radiusd[31843]: Ignoring request to auth address * port 1812 bound to server default from unknown client 192.168.1.192 port 1645 proto udp
*--
Thank you for your help.
Kind Regards,
Bram. - List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html
On Mon, 2018-02-26 at 09:55 +0100, Bram Assendorp wrote:
I have changed it because it's in the wiki " https://wiki.freeradius.org/guide/Syslog-HOWTO"
But it also tells you to remove references to ${logdir} in the rest of your config which you didn't do. In this case however the wiki is out of date. -- Matthew
On Mon, 2018-02-26 at 09:39 +0100, Bram Assendorp wrote:
Within the radiusd.conf I have changed the "logdir" and "destination" parameter to "syslog"
Just set "destination" to "syslog". logdir will still be used for on- disk logs by some modules (e.g. rlm_linelog) unless you also configure them to send to syslog. Your errors are coming from rlm_detail, which uses ${logdir} as the location for the detail files. -- Matthew
Hi Matthew, Looks like it's working now, Thanks for your help! Kind Regards, Bram 2018-02-26 9:55 GMT+01:00 Matthew Newton <mcn@freeradius.org>:
On Mon, 2018-02-26 at 09:39 +0100, Bram Assendorp wrote:
Within the radiusd.conf I have changed the "logdir" and "destination" parameter to "syslog"
Just set "destination" to "syslog". logdir will still be used for on- disk logs by some modules (e.g. rlm_linelog) unless you also configure them to send to syslog.
Your errors are coming from rlm_detail, which uses ${logdir} as the location for the detail files.
-- Matthew
- List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html
participants (3)
-
Bram Assendorp -
Matthew Newton -
Nathan Ward